That #258 issue is for if you use it remotely - which by default it isn't and I don't. The other issue you raise is based on top of that. So as long as you're using KeepassHttp with localhost then you should be ok.

So a slew is not necessarily accurate. But I take you're point, it's definitely a similar weak point that LastPass has.